Update release notes for 19.11.11 release

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Increment version for 19.11.11 release

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Fixing po files for 19.11.11

Translation updates for Koha 19.11.11

(cherry picked from commit 681d698a6ac8eecde2179dd58c6a60eb036bccf8)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26592: [19.11] (rmaint follow-up) Fix JS error when using patron autocomplete searchbar

Merge branch 'new/security-release-19.11.11' into 19.11.x

Bug 26592: [19.11] Prevent XSS vulnerabilities when circ/ysearch.pl is used

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
(cherry picked from commit ca9c9225987814c1606f5241dfa1da3e267b177e)

Bug 26562: [19.11.x] Removes 'searches' from localStorage on logout

A user recently logged in will inherit the "searches" item stored in localStorage.

To recreate:
Log in with user A, do some searches
Note that the "searches" item is filled in with the search queries
Logout and log in with user B
Note that the "searches" item is still there

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25913: Get the correct return of AddBiblio

We need the parenthesis to get the biblionumber and not the
biblioitemnumber, in case there is a discrepancy.

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 08386fabcbfbc29f23091f6fd7838fcb362abed3)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 4b2e6d56f2d54d12f22982bbcf23cdc6e790e961)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25913: Prevent get_coins to crash if record does not have title

If a bibliographic record does not have a title, get_coins will crash
with
Can't call method "as_string" on an undefined value at /kohadevbox/koha/Koha/Biblio.pm line 645
Koha::Biblio::get_coins('Koha::Biblio=HASH(0x5558f91bb740)') called at /kohadevbox/koha/catalogue/ISBDdetail.pl line 144

We can handle that situation easily by checking the existence of the
title field.

Test plan:
1. Create a record without 245
2. Enable COinSinOpac
4. Go to the ISBD detail view
=> It must not fail with this patch applied

Signed-off-by: Heather Hernandez <heather_hernandez@nps.gov>
Signed-off-by: Joonas Kylmälä <joonas.kylmala@helsinki.fi>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 64c939ca80a306af2560c99da0f58b1aeaed13c6)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit d9599a6d3376df3479e040628d61b55aa88e1966)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26260: Add missing elastic>cnx_pool to koha-conf-site.xml.in

Added by bug 22705, but only in etc/koha-conf.xml

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 33ab3c690076bf78d62105502b6de54e45e766b2)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit bbfa9c3a9a9ae59eae50a3d97287772389edf6ce)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 24780: Make items.stocknumber show up in batch item modification

It looks like the field was intentionally removed from the list
of batch editable fields in the past. This makes sense as we
used to have a unique index on it at some point - but we do have
no more.

This removes the exception so that the invendory number behaves
like the other fields on the batch item edit form.

To test:
- Create some items with and without stocknumber
- Go to tools > batch item modification
- Enter the barcodes of your selected items in the list or
  upload a file with them
- Verify that the stocknumber/inventory number is not showing
  in the item edit form below
- Apply patch
- Reload the page - inventory number is there now
- Batch edit the inventory number and verify it works as expected

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 0afcf3936a6ceeb865fdf0159cf54618400847d7)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 1754df0b1959b2e3514f771e7cd499d13c847a0c)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26224: Prevent double submit of header check in form

To test:
 1 - Browse to Home
 1 - In the header bar select the 'Check in' tab
 2 - Type a barcode into the box
 3 - Hit Enter as many as times as you can
 4 - Check the statistics table:
    SELECT * FROM statistics WHERE itemnumber={itemnumber} AND DATE(datetime)=CURDATE();
 5 - Note you have multiple lines for the same item at the same time
 6 - Apply patch
 7 - Reload the page
 8 - Type the barcode
 9 - Press Enter even more fast and more furiously
10 - Check the statistics table
11 - Only one entry, huzzah!

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 5d5a49a7ef165b7b47dda6357aaf2953dacfa362)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 51d3010b71f3f30492f6c0655ef2fd06ba909690)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26414: Tidy the tests

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 3cd40f7bafe99c72b804dc1d6ff993fbc71f2d85)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 496cd5d36e2071e8e124ce2a7472fdc7c6c49ac2)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26414: Unable to export Withdrawn status using CSV profile

When using CSV profiles to export MARC records, it is impossible to export the withdrawn status. I suspect it is because withdrawn is in 952$0 and 0 is considered null rather than an actual 0.

Test Plan :
1) Go to Tools > CSV profiles
2) Click on New CSV profile
3) Enter a profile name (ex. Simple record)
4) In the Profile MARC fields field enter the following (for MARC21)
245a|100a|952o|9520
5) Save your profile
6) Go to Search and search for something
7) Add a couple of things in your cart
8) Go to your cart
9) Click on Download and choose your CSV profile
10) Open the file and notice the 9520 column contains the whole of the 952 field and not just the withdrawn status
11) Apply patch
12) Redo steps 9) and 10)

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit b048d155bf18d794d2ac97eaafc6f0fc00996018)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 937e831ea300042e7be89fc9524bb871edaf23ba)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 18958: DBIC

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 18958: DBRev 19.11.10.001

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 18958: (Rmaint follow-up) Adjust number of tests

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2e5961b2c3e3cf9c74ff0689dcd4b38da1154418)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 18958: (follow-up) Ensure hold fill target reserve_id is set for all hold types

MapItemsToHoldRequests has three sections: Local holds, item level holds, bib level holds

Only one of them was setting the reserve_id. This patch makes al three set it and adds tests

To test:
1 - Repeat test plan on bug
2 - sudo koha-mysql kohadev
    SELECT * FROM hold_fill_targets
3 - Ensure reserve_id is set at appropriate times
4 - prove -v  t/db_dependent/HoldsQueue.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Bug 18958: (QA follow-up) Fix number of tests

In HoldsQueue.t

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit b255ca7c6eec7be3027e6ade00d8477102062281)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit bac2e6892a817482f14249aceb1420c2700416d6)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 18958: (QA follow-up) Add missing comma to kohastructure.sql

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 5cfbe318d84dbaf1af8699f3e499f2c3e312a7af)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit dbb9e36c68de686a9f6f6b8ba63c2f58006bd6d5)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 18958: Make hold_fill_targets specific to reserves

After looking at Marcel's comments, the problem is in our matching
to hold_fill_targets - rather than adjusting to find filled/waiting holds we
could ensure that hold_fill_targets only refers to the specific hold it
is intended to

This patch is clearer, if slightly less performant than last (we now return all
the reserves and have to find the 'highest')

Test Plan:
 1 - Create and use a patron that can place multiple record level holds per record
 2 - Create a record with X items, each at a different library
 3 - Place X 'Next available' holds on the record for the patron using the 'Holds to place' box
 4 - perl misc/cronjobs/holds/build_holdsqueue.pl
 5 - Check in LibraryA's copy as LibraryA and confirm the hold
 6 - Revisit request.pl for the record, notice the next hold in line is now item-specific
 7 - Checkout the item to the patron, notice the remaining hold is marked waiting
 8 - Attempt to place another hold for your patron, notice that it requires an item-specific hold
 8 - Apply this patch
 9 - Repeat steps 1-5
10 - Revisit request.pl for the record, notice the next hold in line has *not* become item-specific
11 - Checkout the item to the patron, ensure the first hold is filled and the second remains record level
12 - Repeat whole test plan without building holds queue to confirm holds are still treated correctly

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 0bfe336c7b0a8993411bd45b9e7c66228730f86d)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit a120656eca586ecd2005421e37fbf8485131ea45)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 18958: Unit tests

Signed-off-by: Bonnie Gardner <bgardner@cityoflewiston.org>
Signed-off-by: Bouzid Fergani <bouzid.fergani@inlibro.com>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
JD amended patch: perltidy and simplify item/biblio creation

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 7ee2495f321198548b3ffbf983aa1d13f6c6c2cc)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit e4b60c41566b0e602bde1301d88f3d8803ff75bc)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26510: Transport Cost Matrix editor doesn't show all data when HoldsQueueSkipClosed is enabled

If HoldsQueueSkipClosed is enabled, and a library happens to be closed
on the day you edit the transport cost matrix, all the values for that
library will not show. Instead they will appear disabled, and if you
were to edit the cell and save a new value in it, it will also
'disappear' when the page is reloaded.

Test Plan:
1) Set today as a holiday for a library
2) Set HoldsQueueSkipClosed to 'open'
3) Go to the transport cost matrix editor
4) Edit a cell where the 'from' is for the closed library
5) Note the value doesn't 'save', it is still in the database though
6) Apply this patch
7) Restart all the things!
8) Reload the transport cost matrix editor
9) The value now appears correctly!

Signed-off-by: Lisette Scheer <lisetteslatah@gmail.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 26ab04a3b383f5a9c88124625f8edc1c4cf1d816)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit eab46b1758cc4749aba581469f40a8405f79fb2b)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26434: Fix plugin dirs addition to @INC

Plugin dirs defined in koha-conf.xml are added to @INC in order to compile perl code.
Looks like with plack those dirs are added several times.
This may lead to an error "INCLUDE_PATH exceeds 64 directories".

This bug was identified with Carrousel plugin : https://inlibro.com/instructions-carrousel/

Test plan :
1) Enable plack and plugins
2) Look at page about.pl : @INC contains one plugin dir 'var/lib/plugins'
3) Install plugin KitchenSink : https://github.com/bywatersolutions/koha-plugin-kitchen-sink
4) Dont apply patch
5) Use configure on KitchenSink
6) Look at page about.pl : @INC contains server plugin dir 'var/lib/plugins'
7) Apply patch and restart plack
8) Use configure on KitchenSink
9) Look at page about.pl : @INC contains one plugin dir 'var/lib/plugins'

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit dcdc72aee7d835c08ca3565a83a3dae7389a4f87)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit aaef04500654a997f722c17adff017a0a4687e8d)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26231: Remove incorrect use of AddAuthority() when 001 present

This patch removes the use of AddAuthority with a non-empty
authid argument, since that triggers an update rather than an insert.

In practice, the update also fails, but the error isn't raised,
as the database connection doesn't have RaiseError set.

Test plan:
1) Do not apply patch
2) Try to bulkmarcimport an authority file with a 001
3) Observe that the script reports success but no authority is added
4) Apply the path
5) Try to bulkmarcimport an authority file with a 001
6) Observe that the script reports success and the authority is added

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 9622561636387ced932cc31e285d13cdba607c47)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 276602aadbdb27cbec780c9564b93ccd0c1961b6)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 10921: Prevent an order from a closed basket to be edited

We don't allow editing of orders that are part of a closed basket, but
we don't enforce the rule in the controller file.

This patch use output_and_exit to stop the script and display an error
to the end user.

Test plan:
Create a basket, add an order
On the basket view you see the "Modify" link, open it in a separate tab
=> You can edit the basket
Keep this tab open, get back to the other one and close the basket
Reload the tab with the order edition form
=> You cannot longer edit the basket

QA: Do we need a check in addorder.pl as well?

Signed-off-by: Henry Bolshaw <bolshawh@parliament.uk>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 0310e973a4c28a7e02baad03799eb40869ce4506)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit deffb12491fa1a928a427b25f55ea5929f030266)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26049: Replace li with span class results_summary in UNIMARC intranet XSLT

In all XSLT for record display, fields are created with <span class="results_summary> except in UNIMARC intranet where there is just <li>.

This allows a better CSS customisation and closer code in files for OPAC and intranet.

Actually li gets diplayed with a dot at each line, we don't want this.

Test plan :
1) For each modified file run 'xsltproc file.xsl' and see there is no
   error
2) Use default XSLT in all system preferences
3) Perform a search and check display with and without patch
4) Click on a record to see details and check display with and without patch

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 9db369fb58c1f2795f748e972397f1ecb882ce92)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 03e585ad5f951a3cc2bb684c11b829e5ce854f4c)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26420: Use translated notices for overdue_notices.pl

This script does not pass the patron's preferred lang for notices.

Test plan:
Enable TranslateNotices
Create a patron with a preferred lang for notices != default
Translate ODUE for this language
Setup the overdue notices for this patron's category
Check an item out for this patron (select the correct due date to
trigger the notice)
Run the script overdue_notices.pl
Check the message_queue table and confirm that the notice enqueued is
translated

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 8e397330f687bd0e9e39387e32a8a8acbbb3b31a)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit eb88ec34bffb57554f31e7b56cd40b37aaa08e6b)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25273: (follow-up) Don't die on unknown authtype

We are guessing authtype code and inserting the heading built accorindg to C4::Heading

If we can't identify the auth type, we can format the heading. There is a record in the koha test
data that is missing the heading field so type cannot be idenfitied

This prevents us from dying n a record where we cannot identify the type.

Note: This code will also be triggered for custom authority types, higlighting
that they won't link because of hardcoded mappings in C4::Heading. We must tackle this
on a new bug

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 5a87514b2e44d64807422b29f719b29b0c9d1ba4)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 401133b5b167708c4942d46d0ed164a2ceefbdfa)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25273: Make match-heading rely on authority type configuration

The match-heading field is a special field used only by the linker, not accessible
to staff or patrons via the interface. This field is used to store the constructed
'search form' used for matching bib headings to authority fields.

In bug 24269 I attempted to use the mappings defined in the inferface and also inject the search term.
This did not work as too many subfields were indexed on their own and leading to false matches.
In this bug we remove the mappings for this field, and create it ourselves during
the indexing process. The C4::Headings module is still used to generate the correct form,
however, the mappings are set based on the authority types in the system. This gives the user
the ability to add new typoes, but prevents mapping changes from breaking linker functionality

To test:
 1 - Start form a sample database with ElasticSearch working
 2 - Download via Z39.50 2 authorities, one of which is a narrower heading of the other, e.g.:
    Waterworks
    Waterworks - Costs
 3 - Place a heading for the broader term in a record. e.g. Waterworks
       In 650$a, without the cataloguing authority plugin. We don't want
       the link created now.
       You need syspref BiblioAddsAuthorities => allow
 4 - Make sure linker is set to default
 5 - Attempt to link the records
       misc/link_bibs_to_authorities.pl
 6 - Linking fails
 7 - Apply patch
 8 - refresh index settings (if using a custom file, remove 'match-heading')
       You can reset mappings in the UI or run this:
       misc/search_tools/rebuild_elasticsearch.pl -v -d -r
 9 - Reindex ES
10 - Try to link again
11 - It succeeds!
12 - Run the tests
     prove t/db_dependent/Koha/SearchEngine/Elasticsearch.t

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Bug 25273: (follow-up)

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit ce161fda9b7d47e3cfcbc73ddb877eed627d6313)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5597b666e468af8708c82d2c0d06a6a133e82677)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 20783: Add missing url filters

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>

Bug 20783: Similar changes for OPAC

Signed-off-by: Kelly McElligott <kelly@bywatersolutions.com>
Signed-off-by: Jessica Zairo <jzairo@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>

Bug 20783: Use iframe to embed Youtube videos

WWW::YouTube::Download is broken and not reliable.
Other alternative was to use HTML::Video::Embed but not updated since
years.

The best alternative seems to follow youtube advise and use an iframe
https://developers.google.com/youtube/iframe_api_reference

Test plan:
Put youtube video in 856$u (using different url formats, youtu.be,
youtube.com/embed, etc.)
Enable HTML5MediaEnabled and HTML5MediaYouTube and confirm that the
youtube videos are correctly embeded.

Signed-off-by: Kelly McElligott <kelly@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Hayley Mapley <hayleymapley@catalyst.net.nz>

Bug 26511: [19.11.x] Remove PatronSelfRegistrationConfirmEmail from opac.pref

Test plan:
1. In 19.11 search for PatronSelfRegistrationConfirmEmail and you'll see the sys pref
2. Apply patch
3. System pref should be gone

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Update release notes for 19.11.10 release

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Increment version for 19.11.10 release

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Fixing po files for 19.11.10

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Translation updates for Koha 19.11.10

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Merge branch 'new/security-release-19.11.10' into 19.11.x

Bug 26322: [19.11.x] Permissions not checked correctly for plugins

This patch fixes the logic in a condition to address the fact that
permissions are not checked for plugins. This was due to bad parenthesis
pairing and the lack of good tests for this.

To test:
1. Apply the regression tests patch
2. Run:
   $ kshell
  k$ prove t/db_dependent/Koha/REST/Plugin/PluginRoutes.t
=> FAIL: Tests fail because of bad logic
3. Apply this patch
4. Repeat (2)
=> SUCCESS: Tests pass!
5. Verify the tests cover the use cases that are needed:
   - Anonymous access
   - Real user with wrong permissions (parameters => 1)
   - Real user with right permissions (borrowers => 1)
=> SUCCESS: Needed use cases so we catch any regression are found
6. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Joonas Kylmälä <joonas.kylmala@helsinki.fi>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26322: [19.11.x] Regression tests

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Joonas Kylmälä <joonas.kylmala@helsinki.fi>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26253: (bug 22857 follow-up) Remove duplicated mana_config in etc/koha-conf.xml

It was there already but not at the same place!

Signed-off-by: Didier Gautheron <didier.gautheron@biblibre.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit a4998b7d5758b0bee682fa7485d66390a3657a20)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 8305f582aafe348f5f2697fe5432e162989296b5)
(cherry picked from commit 53c99fcb46b5486ff244cc2b07ba5fad28a3940d)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26388: Do not show 'Renew all' or 'Renew selected' if no renewable items

Additionally, only include renewable items in 'Renew all'

To test:
1 - Check out some items to a patron, ideally:
    Some not renewable because set for auto renewal
    Some not renewable because of holds
    Some renewable
 2 - Confirm 'Renew selected' and 'Renew all' show on the opac
 3 - Click 'Renew all'
 4 - You get errors about the non-renewable items?
 5 - Check in all renewable items
 6 - Confirm you still see renew buttons
 7 - Apply patch
 8 - Refresh and you shoudl not see renew buttons
 9 - Check out a renewable item
10 - Click 'Renew all'
11 - Renewable item is renewed with no error
12 - Try again with 'Renew selected'
13 - Confirm it works as expected

Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 763cc4eb2e53f7a44a138d6162bfa4470a484bac)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 6347ad75c8f48f450ce82042f664bbb2d2bcd03c)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26041: Enable keyboard navigation without 'ctrl'

This patch enables keyboard navigation using the arrow keys without the
need to hold the control key for the jQuery UI datepicker.

Test plan
1/ Navigate to an item in the opac and attempt to place a hold
2/ On the resultant screen, use keyboard navigation to trigger the 'Show
more options' dropdown.
3/ Focus on one of the date inputs using keyboard navigation.
4/ Use 'ctrl + arrow' keys to navigate the datepicker.
5/ Note that prior to the patch using 'bare' arrow keys does not trigger
anything
6/ Apply the patch and confirm that the datepicker can now be naviated
using the arrow keys without holding the ctrl key.
7/ Confirm that using the ctrl key combinations continue to work as
expected too.
8/ Signoff

Signed-off-by: Brandon J <brandon.jimenez@inLibro.com>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit be92f7e79ce093e251c2489408dce3077f782c0d)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 09b5ffe12178894946176588e81d6a1136bce710)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 17801: Use issuedate for limits in Most Circulated Items

To test:
1 - Have two checkouts in old_issues
    issue 1: timestamp 2020-08-01 00:00:00, issuedate 2019-08-01 00:00:00
    issue 2: timestamp 2020-07-01 00:00:00, issuedate 2019-07-01 00:00:00
2 - Perform a Most Circulated Items search for checkout dates 2020-06-01 to 2020-09-01. Both checkouts appear in search
3 - Repeat search with checkout dates 2019-06-01 to 2019-09-01. Neither checkout appears in search
4 - apply patch, restart all
5 - Repeat search with checkout dates 2020-06-01 to 2020-09-01. Neither checkout appears in search
6 - Repeat search with checkout dates 2019-06-01 to 2019-09-01. Both checkouts appears in search

Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 89cc457ca25e0fbaccba28b249ceedeef6573abf)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit ce0988970945b063b514e26d41abd2fbe108177e)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26236: Fix translating interface from DB term to readable term

When viewing the logs we try to swith the db values like 'cron' to friendly terms like
'Cron job'

The values we use for building the selectors on the page ar eupper case, but DB values are lower case

If we simply force upper case in the comparison we can ensure we always match correctly

To test:
1 - Enable some 'Logs' setting in System preferences
2 - Perform some action in koha that will log
    Run a cronjob
    Change a syspref
    etc.
3 - Browse to Tools-> Log viewer
4 - Click 'Submit' to see all logs
5 - Note the 'Interface' column contains lower case DB values
6 - Apply patch
7 - Reload the page
8 - Values in interface are now Camel cased and more friendly

Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 1733944b34499c145c2ae4c68c70efc87a5bec27)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit c08642687d35305cda2948272335530c8fc76b3c)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26271: Add null to the list of accepted account_line data types

The database schema for accountlines table allows the
manager_id/user_id column to be NULL. If request to
/api/v1/patrons/<patron_id>/account returns such an accountline where
it is NULL we get 500 error as response. Adding NULL to allowed data
types fixes this issue.

To test:
 1) Run prove t/db_dependent/api/v1/patrons_accounts.t and notice it
    doesn't fail

Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 089b85758614260b70f43509ccdbc6285629a883)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 67aa733726b13f0437bb11b6cb5d18220caba757)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26271: Add failing test to reveal issue with patrons API endpoint

When manager_id is null/undef the API returns error code 500.

To test:
 1) Notice failure when running
    prove t/db_dependent/api/v1/patrons_accounts.t

Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 898cd3b82ee84682bdfad1c177e2eb6ae0881428)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 00570ae9690a33a9be62dc51aaffa9d3774281f9)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26313: (follow-up) Fix OPAC and "Show volumes" links

Elasticsearch requires the booleans in search requests to
be uppercase. This fixes the "Show analytics" link in
OPAC (same as first patch for intranet) and the "Show volume"
link.

To test both patches:

Set UseControlNumber = Use

1) "Show analytics"
- Turn SearchEngine to Elasticsearch and make sure it works
- Pick any serial record in your database, make sure 001 is set
- Go to new > new child record
- Fill in 245 and save
- For both staff and OPAC:
  - Click on the "In" link, it should bring you to the parent record
  - Click on "Show analytics", it should show your analytical record
- Switch to "Zebra" - verify links still work.

2) "Show volumes"
- Turn SearchEngine to Elasticsearch again
- Pick any serial record in your database, make sure 001 is set
- Set LDR, pos. 19 = a - Set
- Note 001 value
- Find another record and edit it
- Set LDR, pos. 19 = a or b, LDR 7 not a or b (m will work)
- Set 773$ title of set record $w 001 of set record
- For both staff and OPAC:
  - Click on the "In: link, it should bring up your set record
  - Click on the "Show volumes" link, it should bring up the volume

- Switch to "Zebra" - verify all links still work.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 8a37842e1af3fdc9e5e4eb2eb6ec9190ed31915e)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 7a8b7ba2f42c9709301b321f3c8e05bc0af78487)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26313: "Show analytics" link must use uppercase for booleans

In elasticsearch we only treat AND and OR as boolean operators if
they are capitalized

To test:
- Turn SearchEngine to Elasticsearch and make sure it works
- Pick any serial record in your database, make sure 001 is set
- Go to new > new child record
- Fill in 245 and save
- Click on the "In" link, it should bring you to the parent record
- Click on "Show analytics" => there will be no result
- Apply patch
- restart and reload
- Try again
- It works!
- Switch SearchEngine syspref to 'Zebra'
- Test again
- It still works!

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit fde7bf5495dedf681acb3193891de44eec4d2bfa)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 4755e8ef5cc73583f270fb1fe22415f29def46ea)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26331: Make svc/letters/preview executable

Without this patch, you can't preview letters when running Koha in CGI mode.

To test:
1. Run Koha as CGI (and not Plack)
2. Go to /cgi-bin/koha/tools/letter.pl?op=add_form&branchcode=&module=circulation&code=CHECKIN
3. Try to preview the notice (using a valid barcode)
4. Note in the browser console that svc/letters/preview is generating a 500 error

Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit c53dfb5562a12c1a8d8b9d3d0c28cb17d001edb5)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 6e014333589b80be7b0060da8aa3e4e55cfb07ca)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26362: Show correct libraries in overdues report

Currently the overdues report does the following display:
Patron library = home branch
Home library = holding branch
Holding library = patron branch

This patch corrects the display of libraries in the overdues report.

To test:

0) Do not apply patch
1) Go to http://localhost:8081/cgi-bin/koha/circ/circulation.pl?borrowernumber=51
2) Go to http://localhost:8081/cgi-bin/koha/circ/set-library.pl
3) Choose "Troy"
4) http://localhost:8081/cgi-bin/koha/circ/circulation.pl?borrowernumber=51
5) Checkout "39999000004571" with due date of "09/01/2019 23:59"

Note the facts:
Patron library = Centerville
Home library = Fairview
Holding library = Troy

6) Go to http://localhost:8081/cgi-bin/koha/circ/overdue.pl
7) Change "Columns" visibility to show Holding and Home libraries
8) Note that the libraries are incorrect:

Patron library appears to be: Fairview
Home library appears to be: Troy
Holding library appears to be: Centerville

9) Apply the patch
10) koha-plack --restart kohadev
11) Go to http://localhost:8081/cgi-bin/koha/circ/overdue.pl
12) Change "Columns" visibility to show Holding and Home libraries
13) Note that the libraries are correct:

Patron library appears to be: Centerville
Home library appears to be: Fairview
Holding library appears to be: Troy

Signed-off-by: Emmi Takkinen <emmi.takkinen@outlook.com>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit b729886216560fdf50d88dc8214c0dbb58720b5c)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b10162f3a2086be33abd3df45e717d7c6e902388)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25448: Update German (de-DE) framework files

The updated files have been auto-generated based on the
po files and downloaded from
https://translate.koha-community.org/files/

To test:
- Make sure German language is installed, see:
  https://wiki.koha-community.org/wiki/Installation_of_additional_languages_for_OPAC_and_INTRANET_staff_client
- Run the web installer and choose de-DE
- Select all sample files
- Make sure they all install without any errors

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit c0adeab58feaa7fb0b5c97e55b8356bb916aa163)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 8e86f81b4130ce7d6a1e5556b2cfb1a2f19559d6)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25792: Rename 'ttf-dejavu' package to 'fonts-dejavu' for Debian 11

to test...
 1/ attempt to install koha 20.05 package on deb11, fail :'(
 2/ apply patch and build new koha package
 3/ attempt to install new koha package on deb11, succeed!

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 14932ae7d3bf864f64bffc9b1b015a07e11c8e2e)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit a224b116882341fe4f0db09b456db1e20d8ad2e0)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 24147: Don't assume search_related will return ordered values

This test is failing randomly because it assume the order is always the
same. But it's not.

Note: Koha::Objects->search_related is never used , last use removed from
  commit 9aa724cdf29a57bc91e42b240b5bcd19e3814ada
  Bug 19599: Speed anonymise_issue_history up
We should keep it however IMO

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit e10dc503289e8d7e8c742af0111acb79d4d53111)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit e550f25a013f43bec8c2ee1694541dafd2a84a85)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25584: Fix minor styling issue

This patch makes the button present some space between the icon and the
text.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Kelly McElligott <kelly@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 2a0ccf7af26236db9a3e40968cf8f43bc308f142)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 81fd27153a26154da576eaaba7274968b36f1a3f)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25584: Refresh checkouts table when a return claim is added

This patch triggers a checkouts table refresh when a return claim is
added. I also noticed the same when a return claim is deleted so it is
now also refreshed.

To test:
1. Set the ClaimReturnedLostValue to some valid value (2)
2. Check something out for a patron, and choose to display all checkouts
=> SUCCES: There's the checkouts table, showing the checkout
3. Click on the 'Claim returned' button and confirm
=> SUCCESS: There's no 'Claim returned' button anymore
=> ERROR: The checkout row doesn't display anything about the claim
4. Go to the 'Claims' tab, delete resolve and delete the claim
5. Go to the Checkouts tab
=> ERROR: It doesn't reflect the changes either
6. Apply this patch and start over
=> SUCCESS: Once the claim returned is added, the checkouts table is
refreshed and the information updated
=> SUCCESS: On the Claims tab, if you delete the claim and go to the
Checkouts tab, you are presented the button again.
7. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Kelly McElligott <kelly@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 7fc7427dd41ce10070a6a3d3070fb660850be511)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit def41d6231ae204022664d6d2b7de02fbb4c1414)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26324: Fix spelling resizable vs resizeable in Dopop

The correct spelling of the parameter is resizable
https://developer.mozilla.org/fr/docs/Web/API/Window/open

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit ce7f4d16d6acdc6a56d40e6ebd96d722f1c77387)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 1475ea89e5daedf4a5fea29c09feb4ca5561aa39)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26069: Pass correct URL to twitter

We don't provide the url of the detail page so the twitter JS code
retrieve the current location, with the search terms.

Test plan:
Do a search
Click on a result
Click on the twitter button and confirm that the link only contain
biblionumber=x in the parameter

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 5fd8774c687c6aaf6716485ab9bd72a69a0e2f76)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 48b10b3cf5f267b15d8f2008e90e0a88d379fe1d)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 17661: Trivial simplification using += operator

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit c96fabb8c47320dba55372e4b955fb171310adec)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 81865f77777273d96169bfe6afa760e11be0c7da)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 17661: (follow-up) Update regex to support Unicode characters

Rather than limiting initials to [A-Z] we should test for a broad
range of uppercase letters.

The ES/Zebra changes are slightly different because of Perl vs Java regex
conventions. POerl may support either, but I found 'Uppercase' to be a bit more explicit

More info here:
https://perldoc.perl.org/perlunicode.html

TO test:
Same plan as before but use Ж. as the ending initial
Confirm the period is preserved and other punctuation removed

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 224ac84aeca3b8dba87366925d83b01e0f5c1110)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f297fb819c38553899f2cde10b108ca8fa712dce)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 17661: Ending punctuation causes duplicate facets

The current code for facets doesn't pull strip ending punctuation from facets
This causes duplicate facets for terms that should be combined

Sometimes series can have different punctuation depending on the field they are in
Author initials punctuation should be preserved

To test:
1 - Do search and pull up some records
2 - Edit some of the records to have authors like:
    Date, C.J.
    Date, C.j.
    Date, C.J .
3 - Edit the records to have some series statments like:
    830 $aDate, C.J. ;$v5
    830 $aDate, C.J. ; $v5
    830 $aDate, C.J.; $v5
4 - Add some 490s to the record with first indicator 1 and series like:
    You wouldn't want to--
    You wouldn't want to
    You wouldn't want to..
5 - Search again and note you have 3 facets each for author and series
6 - Apply patch
7 - Repeat
8 - Now you get 2 facets for author, period not removed when following Upper case immediately, is otherwise
9 - Now you should have a single series facet
10 - Switch search engine to ES (index before applying patch)
11 - Note facets are separate again
12 - Reset mappings and reindex
   perl misc/search_tools/rebuild_elasticsearch -v -r
13 - Repeat search, facets combined as above

Signed-off-by: Sarah Cornell <sbcornell@cityofportsmouth.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit e34f95a1f5eb0fce238ab442553bec5233263a9c)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 0bfeb9990181445a14e4858b3d61954c1daf30ce)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25958: DBRev 19.11.09.001

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25958: (QA follow-up) Implement filter in database query instead of in loop

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 66382458dc46356818473935e8d5546f13f05645)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 9a544a86dbaa00dfce906f683556fea5d30805fb)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25958: (QA follow-up) Add some punctuation to new DefaultLongOverdueSkipLostStatuses

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit d99651efd0a9a827b91f4575ab6f1d4344c7cfb0)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit bd56e23748f459f983bbca07bc7b019b70192dd5)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25958: Allow LongOverdue cron to exclude specified lost values

When lost items are not marked as returned, they are still subject to
the long overdue cron, so an item that has already been marked Lost may
automatically roll to Long Overdue. In some cases, a library may not
want that lost value to change. This becomes especially important with
the introduction of Claims Returned, which uses a variety of lost.

Test Plan:
1) Set up a long overdue item that would be moved to lost by longoverdue.pl
2) Run the cronjob with the new --skip-lost-value option
3) Note the item is not altered
4) Include that value in the new system preference DefaultLongOverdueSkipLostStatuses
5) Run the cronjob *without* the new option
6) Note the item is not altered
7) Run the cronjob again with the new command line option, but set it to
a different value so the item will be affected
8) Note the item is altered as it would have been before this patch was
applied

Signed-off-by: Lisette Scheer <lisetteslatah@gmail.com>
Signed-off-by: Rebecca Coert <rcoert@arlingtonva.us>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 48edb2947163c1e9a70b11de40a71ebed747952f)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 411619f209d071a8e2250a8979f3a336827dafb5)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 21539: addorderiso2709.pl forces librarian to select a ccode and notforloan code when using MarcItemFieldsToOrder

There is no reason that MarcItemFieldsToOrder should force librarians
to select a ccode and notforloan value for each item.
They are both optional fields.
As with location, the first value should be an empty 'none' option.

Test Plan:
1) Set up MarcItemFieldsToOrder, do *not* set mappings for ccode and notforloan
2) Add an order record to a basket that uses MarcItemFieldsToOrder
3) Note you must choose a ccode and nfl value
4) Apply this patch
5) Reload the page
6) Note you no longer have to select values for ccode and notforloan

Signed-off-by: Daniel Gaghan <daniel.gaghan@pueblolibrary.org>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 0c79b7d93b96434ddf91c6ddabb1570836736a15)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 5f6b557599b83e0230a3dca5b527924e883d17a3)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25791: Remove win.print()

Test plan:
1) Turn on system preference SelfCheckReceiptPrompt
2) Check out item via /cgi-bin/koha/sco/sco-main.pl
3) Click "Finish"
4) Click 'Print receipt and end session'
5) Notice two print dialog boxes right on top of each other
6) Apply patch
7) Repeat steps 1 - 4
8) Should only get a single print dialog.
9) Test in FF/Chrome and make sure behavior is consistent

Signed-off-by: Kelly McElligott <kelly@bywatersolutions.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 6797f07bbdfb90c556f52bfe2f83cefdf91495f3)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 59b67c3b37ed92926e9c75c0637c58af255ecec2)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25903: Add unit tests

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 49f5200374e9a381ab7398730e42c0beefc0f2a4)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 73c246238bc21aa48689a8027cd3ae01fb7f9232)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25903: Sending a SIP patron information request with a summary field flag in indexes 6-9 will crash server

The 'summary' field in the patron information request specifies if detail information should be send for holds,
overdues, fines, etc. The field is 10 characters in length (0-9). However, the SIP2 spec only defines indexes 0
though 5, leave 6 though 9 undefined. Some ILSs specify behavior for these undefined indexes. Apparently the
7th field is often used to request 'Fees', as opposed to 'Fines' in some ILS. Some software that integrate via
SIP try both the 5th and 7th indexes to ensure they get all fines and fees.

The problem is that Koha's SIP server crashes if any 'summary' index beyond 5 is flagged. We should simply
ignore flags beyond 5 and act as if no flags were sent.

Test Plan:
1) Enable SIP for your instance
2) Send a patron information request with a summary flag in any index beyond 5.
   i.e.: 6300120200617    124846      Y   AOMIDAY|AA21030050054321
3) Note the SIP server just closes the connection without a response
4) Apply this patch
5) Restart the SIP server
6) Send the same request
7) Note you get back the patron information response!

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Jeff Gaines <jgaine@arlingtonva.us>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit fd4dbba7fb25bb73bcee152c84e704f9796664fd)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit b870bac520083283abb199a059ed767165ead677)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26076: (QA Follow up) Prevent error by using a fresh resultset

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit c9887a87538b2113c48db8cd2751a4bcf2bd2168)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 3a4f76b60d880fabb5bb6637839d1a83e673e1d6)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26076: Sum the amount due in the database query instead of a loop in Perl

This appears to be a bug due to inaccuracies in floating point math. I've been unable to reproduce it on demand. Sometimes when using the "Write off selected" button, Koha will give the error that the payment is more than the amount owed, even though they are the same. The solution I've implemented is to move the summation from Perl code to the database query. This video demonstrates the issue and afterward, shows the error goes away after the patch is applied: https://monosnap.com/file/pG69HC7iI9mU9kkuoCtbkVzVTffKlE

Test Plan:
1) Apply this patch
2) Restart all the things!
3) Verify that "Write off selected" functions as usual

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 64412969037ac9a9f81f05c69c3dd43bd3cab90b)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2e3b3a23fc6c3c1183853a6b5022598930b55b0d)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26233: (bug 25553 follow-up) Make date columns sortable on the edit items table

We were missing to pass the title-string to datatables.

Test plan:
Retest bug 26233, with appropriate dates

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit df5c9d0725dec84a3d57f97a7728cbc7e1cac9fc)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25778: Fix var scope in koha-plack for PERL5LIB and KOHA_HOME

Currently, if a koha-plack is given multiple instances, it will create
duplicate $KOHA_HOME/installer and $KOHA_HOME/installer/lib entries
in PERL5LIB as these changes are done at the global rather than local level.

This issue can only be seen in non-dev Koha, since dev Koha installs
rewrite PERL5LIB.

This patch localizes PERL5LIB to each instance.

To test dev installs:
0. cp debian/scripts/koha-plack /usr/sbin/koha-plack
1. koha-plack --restart kohadev
2. Note that nothing breaks

To test non-dev installs:
0. Don't replace /usr/sbin/koha-plack yet
1. Create multiple non-dev installs with plack enabled and running
2. Set up one of these non-dev installs so you can use the web
UI (that is beyong the scope of this test plan)
3. koha-plack --restart test1 test2 test3
4. For test3, go to /cgi-bin/koha/about.pl
5. Note that there are duplicate /usr/share/koha/installer
and /usr/share/koha/lib/installer entries in PERL5LIB
6. cp debian/scripts/koha-plack /usr/sbin/koha-plack
7. koha-plack --restart test1 test2 test3
8. For test3, go to /cgi-bin/koha/about.pl
9. Note that there are no duplicates entries in PERL5LIB

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 89721cb42b3928c745677c70fd9061273d1848dd)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 670193ad16c7d5e6f288bc6288a0a033f8e02026)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26213: Remove the use of jquery.checkboxes plugin when adding orders from MARC file

This patch removes the use of the jquery.checkboxes plugin from the page
for adding orders to a basket from a staged MARC file.

This patch fixes an unreported bug wherein the "select all" and "clear
all" controls affected not only MARC record checkboxes but also the
"show inactive funds" checkboxes.

To test, apply the patch and go to Acquisitions.

- Go to Vendor -> Add to basket -> From a staged file.
- Select a staged file with multiple records.
- Test the "Select all" and "Clear all" links at the top of the "Select
  to import" tab. They should work correctly to select and deselect
  checkboxes corresponding to staged MARC records.

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 8344ee7b4ced266ac7bd48254f4695175fd8f19b)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit f681964591ba1efde4c1c8c032c344b85c1d1815)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25751: Add ORDERED in dropdown list of suggestion's statuses

The status "ORDERED" is missing from the pull down list of
status values when editing a suggestion, so the first
option is selected "No status".

This leads to data loss when editing a suggestion in the
status "ORDERED". Worse: the status can't be reset to
"ORDERED" and so no AVAILABLE notice can be sent to the patron.

Test plan:
- Create a suggestion, accept it, create a new order from this suggestion.
- Verify status is "ORDERED"
- Edit the suggestion
=> Without this patch the dropdown list does not have
   "Ordered", and if you save you lost the status
=> With this patch applied the dropdown list has "Ordered"
   preselected. You can save and preserve the status.

Signed-off-by: Holly Cooper <hc@interleaf.ie>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit eeb7ac6fc0d14c9e731b7759c78f37cadcfa575f)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit c320dfa3beef2bce10e87572ee9dd7f6849a694f)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25750: fix fallback to ecost_tax_included/ecost_tax_excluded

If 'Actual cost' has not been set then it has the value of 0.00 which
Perl evaluates to true so this patchset resets it to 0, so the fallback
to ecost_tax_included/ecost_tax_excluded happens.

Test plan:
1. Add item to acquisition basket (make sure the vendor has: tax rate: 15%, 'List prices: Include tax', 'Invoice prices: Include tax')
2. Set 'Vendor price' = 10 and do not set 'Actual cost'
3. Save order
4. Observe basket.pl shows 'Total tax exc.' has a value of 0.00 and GST
column has value of -8.70

5. Jump into the database:
select tax_value_on_ordering from aqorders where
ordernumber=<ordernumber>;
[You can get the ordernumber from clicking on the 'Modify' line the item
is listed in]
6. Observe a negative value: -8.70

7. Apply patch and restart plack
8. Add a second item to the basket
9. Set 'Vendor price' = 10 and don't set 'Actual cost'
10. Save order
11. Observe basket.pl shows 'Total tax exc' has value of 8.70 and GST
has value of 1.30
12. Repeat step 5 and observe tax_value_on_ordering = 1.30
13. Run t/Prices.t unit test:
sudo koha-shell <instancename>
prove t/Prices.t

Sponsored-by: Horowhenua District Council, NZ
Signed-off-by: Andrew Fuerste-Henry <andrew@bywatersolutions.com>
Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 7b66b90fe707e8ac650a1c85d87560fc2f4a223d)
(cherry picked from commit 3bbf6384492834055d38ac844521be6c02d503ab)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26119: Enable patron's attribute edition when PatronSelfRegistrationVerifyByEmail

There is no good reason remove the ability to edit patron's attributes
if PatronSelfRegistrationVerifyByEmail is set.

We cannot have them in the self-registration form (because we don't
store patron's attributes during self-ref), but we can have them when
a patron show/edit their information.

Test plan:
0. Enable PatronSelfRegistrationVerifyByEmail and create patron's
attributes that can be edited at the OPAC
1. Create a new patron using the self-reg feature
=> You don't have the ability to fill in the patron's attribute
2. Edit your personal details (OPAC)
=> Without this patch you still don't see the patron's attribute that
can be edited at the OPAC
=> With this patch applied you can!
3. Notice the wording change on the "Modify patron attribute type" form
and confirm it makes sense

Signed-off-by: Sally <sally.healey@cheshiresharedservices.gov.uk>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit fc22fb308bdbfc6d1bda3448e966542f2828ad76)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit ae54212e7d05564332dbb28b99ed61103cdecaae)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26228: Update gulpfile to work with Node.js v12

This patch makes the gulpfile work with gulp v4 on Node v12. To test it,
make sure your dev env has Node.js v12.

It also replaces the use of 'gulp-util' (deprecated) by 'minimist' as
recommended on their site.

On both KTD and KohaDevBox edit your sources.list so the node line
points to 'node_12.x' instead of 'node_8.x'.

Once that's done:
1. On your clone run:
   $ yarn install
   $ npm install -E
2. Build the CSS:
   $ yarn build
   $ yarn build --view opac
=> SUCCESS: Things build correctly
3. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit a7e3c12e6175e19299e7bdbe60d1bc7d41d45ce8)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 65f443f22f78600979a36a422c8f1e71f580ee18)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26078: (follow-up) Use a boolean rather than changing returnbranch

Bug 26078: (follow-up) used validTransfer instead of checking WrongTransfer message

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit d8f3e0ec0dbaf73075299a88a254334cfaf1d29e)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 0b444c4bc0f3a677acfc2423b19a04ddea8b9dff)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26078: Prevent generating a new transfer from return policy when resolving a transfer

To test:
- Have 2+ branches
- Set your default return policy to Item returns to issuing library
- Find an item with holding branch of Branch A
- Set your library to Branch B
- Check item in
- Koha generates a transfer to Branch A. In doing so, it sets the item holding branch to Branch B
- Set your library to Branch A
- Check item in
- Koha generate a transfer to Branch B. In doing so, it sets the item holding branch to Branch A
- Set you library to Branch A
- Check the item in
 . . . Repeat indefinitely.
 Apply patch
 Repeat
 No more loop

Signed-off-by: Sally <sally.healey@cheshiresharedservices.gov.uk>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 47671123206a475f86de9316d8b256e14aa54bc1)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 8bd9c4b4fd44990c7a806de21e8628e1955a3c56)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26090: Fix "item types" report

This report was broken with SQL strict mode, but also without.

DBD::mysql::st execute failed: 'koha_kohadev.itemtypes.itemtype' isn't
in GROUP BY [for Statement "

and, if no library was selected:

DBD::mysql::st execute failed: Unknown column 'biblioitems.itemtype' in
'field list' [for Statement "

This patch does the minimum to make it usable, but it would need more
love.

Test plan:
To test you will need to try the 4 combinaisons:
 item-level_itypes = item or biblio
 With or without a library selected in the dropdown list

Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 5bca73080f89bb2f4ca83ce6ceb9fa8e3c4a7d92)

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 69f16f7469c7cbbf571560d6f9389ef2dd170aa7)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25786: Holds Queue building may target the wrong item for item level requests that match holds queue priority

Bug 23934 removed the limitation that prevented item level holds from
getting local holds priority. The problem is the code has never checked
if the item level hold matches the given item! This means the wrong item
may be requested to fill an item level hold.

Test Plan:
1) Create 3 items on a record
2) Place a hold for the 2nd item you created
4) Ensure that hold would be picked up by local holds priority
5) Build the holds queue
6) Note the holds queue is asking for the wrong item!
7) Apply this patch
8) Rebuild the holds queue
9) Holds queue should now be asking for the correct item!

Signed-off-by: Kim Peine <kim@williston.lib.vt.us>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit b17a04dd077bb118086ad9e4bb58eee81ade2cdd)
(cherry picked from commit c6a1277fdb84df93be2cfa5cb0fa47c950116c20)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25783: Modify calls to AddReserve to match Koha 19.11.x AddReserve prototype

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25783: Holds Queue treating item-level holds as bib-level

The holds queue builder does not honor
the new item_level_hold flag. Instead, it only item_level_request if
in the loop dealing with item level holds. This is incorrect. Item level
holds may be trapped in the local holds priority loop as well. It's
trivial to just pass though the correct item/biblio level hold flag.

I do not know how to write a reproducable test plan for these issues.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Kim Peine <kim@williston.lib.vt.us>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit db235d33a4caf64387b86ebab7b658bd7759ff21)
(cherry picked from commit aa4eba6d232fd5009312286f5e3575c4ca25e9f3)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25783: Regression tests

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Kim Peine <kim@williston.lib.vt.us>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit dd4970860d4299c89ce4a698644c08f990bc1468)
(cherry picked from commit ad6b6db41e92168a3e23d64949817fddb8927aa0)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26361: switch TableSettings to ColumnSettings

Test Plan:
-Be on 20.05.x
-Go to returns.tt
-See the error Uncaught SyntaxError: expected expression, got keyword 'var'.
-Apply patch
-Reload returns.tt, no error

Signed-off-by: Fridolin Somers <fridolin.somers@biblibre.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
(cherry picked from commit 2b6b7cb265acc77f8925eec9a9f315f249a85348)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25005: (bug 22868 follow-up) Fix suggestions pending on main page

There is a "Suggestions pending approval" link on the main page that is
displayed if there are new suggestions and the logged in user has the
permission to manage them.

On bug bug 22868 the permission changed from
acquisition.suggestions_manage to suggestions.suggestions_manage

But in the template, one occurrence has not been replaced correctly
(certainly because it was already wrong actually).

Test plan:
Create a suggestion at the OPAC
Create a patron with the suggestions permission
Use this patron to login at the staff interface
=> Without this patch the link does not appear on the main page
=> With this patch applied the link appears

Signed-off-by: David Roberts <david@koha-ptfs.co.uk>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26270: Fix ThingISBN after a change in behaviour

This is just a guess! One of our tests is failing since today and we
don't modify anything in this area.
My guess is that the service is now returning the normalized version of
the ISBN

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 26136: Prevent double submit on checkin-form

To test:
 1 - Browse to Circulation->Check-in
 2 - Type a barcode into the Check in box
 3 - Hit Enter as many as times as you can
 4 - Check the statistics table:
    SELECT * FROM statistics WHERE itemnumber={itemnumber} AND DATE(datetime)=CURDATE();
 5 - Note you have multiple lines for the same item at the same time
 6 - Apply patch
 7 - Reload the page
 8 - Type the barcode
 9 - Press Enter even more fast and more furiously
10 - Check the statistics table
11 - Only one entry, huzzah!

Signed-off-by: Sally <sally.healey@cheshiresharedservices.gov.uk>
Signed-off-by: Josef Moravec <josef.moravec@gmail.com>
Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
(cherry picked from commit 44f54aac602ae99d83d954a2f102d77ff93ecfa7)
(cherry picked from commit 9d85636bf0db1350fb4f7e83e6cca2fcc0b1038b)

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Update release notes for 19.11.09 release

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Merge branch 'new/security-release-19.11.09' into 19.11.x

Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 24663: [19.11.x] Handle special cases for recovery password and selfreg

The password recovery and self-registration features need to be
accessible at the OPAC even if not public.

Test plan:
Self register a new account, then ask for a new password with OpacPublic
turned off

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 24663: [19.11.x] Force authentication in svc/records/preview (?)

Was this wrong?

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomás Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 24663: [19.11.x] Force auth in adveditorshortcuts.pl

This was wrong!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 24663: [19.11.x] Remove authnotrequired if set to 0

It defaults to 0 in get_template_and_user

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 24663: [19.11.x] Test OpacPublic for all OPAC scripts

Prior to this patchset there were 3 different calls to
get_template_and_user (or checkauth) with the authnotrequired param:
 * authnotrequired => 0
 * authnotrequired => 1
 * authnotrequired => ( C4::Context->preference("OpacPublic") ? 1 : 0 )

The first one says that an unauthenticated user can access the page, the
second that the user has to be authenticated, and the last one that it
depends on the OpacPublic syspref.
Actually we must replace the first one with the third one, if the OPAC
is not public, the authentication must be forced.

To do so we are going to remove the "authnotrequired => 0" occurrences,
and check the OpacPublic syspref's value in C4::Auth

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25360: (follow-up) Remove the https FIXME in Auth.pm

The FIXME is no longer valid since we fixed the X-Forwarded headers
for Plack. And since we do not even use using_https anymore in
the templates (see bug 21094).

Test plan:
Run Auth.t
Git grep for using_https

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 25360: Use secure flag for CGISESSID cookie when using HTTPS

This patch adds the secure flag to the CGISESSID cookie when using HTTPS.
This prevents the cookie being used again over a normal HTTP
request.

Bug 25360: [Follow-up] Test for "on" or "ON" value for HTTPS env var

This patch tests for HTTPS "on" or "ON" before setting the secure
cookie.

Bug 25360: [Follow-up] Fix typo in C4/InstallAuth.pm

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
[EDIT] Amended number of tests in Context.t
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>

Bug 23634: (QA follow-up) Our PUT is really a PATCH

This patch makes the controller not expect that there will always be all
the email fields. So it now checks if an email field was passed, and
changed, and renders the error if that stands.

To test:
1. Run:
   $ kshell
  k$ prove t/db_dependent/api/v1/patrons.t
=> FAIL: Tests written by Nick highlight a problem
2. Apply this patch
3. Repeat 1
=> SUCCESS: Problems solved
4. Sign off :-D

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>
Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com>